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Top Stories 

• Six suspects were charged in Salt Lake City March 5 for their alleged roles in a loan 
modification scheme that defrauded over 10,000 individuals nationwide out of more than 
$33 million. - National Mortgage News (See item 4 ) 

• An Amtrak train crashed into a semi-truck on the tracks at the intersection of Highway 301 
and North Carolina Highway 903 (N.C. 103) in Halifax March 9, derailing the train and 
leaving 55 passengers injured. - WRAL 5 Raleigh (See item 5 ) 

• Two ships collided in the Houston Ship Channel near Morgan’s Point in La Porte, Texas, 
and spilled an unknown amount of MTBE into the water prompting the closure of the 
channel in both directions March 9. - KHOU 11 Houston (See item 8) 

• The Florida Department of Education Commissioner reported March 9 that the State’s new 
online standardized test was the target of a cyber-attack March 5, causing issues with log- 
ins and prompting computer screens to turn white. - Associated Press (See item 14 ) 
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Energy Sector 



1. March 9, Carlsbad Current-Argus - (New Mexico) $38K of equipment taken from 
power plant substation. Officials in Eddy County reported a power plant substation 
burglary on NM 3 1 where thieves stole about 4,000 feet of copper wire and several 
other tools worth an estimated $38,835 after gaining access to the substation by cutting 
the lock. 

Source: http://www.cuiTentargus.com/carlsbad-news/ci 27676653/38k-equipment- 
taken-from-power-plant-substation 

For another story, see item 8 
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Chemical Industry Sector 

Nothing to report 
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Nuclear Reactors, Materials, and Waste Sector 

Nothing to report 
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Critical Manufacturing Sector 

2. March 10, Help Net Security - (International) Hacking Nest Thermostat. TrapX Labs 
researchers proved vulnerability in the Nest Learning Thermostat that was first 
presented at the Black Hat 2014 conference by compromising the devise within 
TrapX’s Advanced Test Bed Facility, then providing real-world validation by 
compromising a device that was installed in a participant’s home network. The 
researchers were able to use the device as an initial point of attack to gain access to the 
entire home network, allowing them to tracker users’ Internet activity, access private 
credentials, and use the thermostat’s data to determine whether or not anyone was at the 
home. 

Source: http://www.net-security.org/secworld.php?id=18062 
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Defense Industrial Base Sector 

Nothing to report 
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Financial Services Sector 



3. March 10, Hudson County Jersey Journal - (New Jersey) Former Kearny 
councilman pleads guilty in $13M mortgage fraud scheme. A former Kearny, New 
Jersey councilman pleaded guilty March 9 to his role in a $13 million mortgage fraud 
scheme in which he and co-conspirators recruited straw buyers from 2006-2011 to 
purchase condominiums and creating $4.7 million worth of mortgages based on false 
and fraudulent loan applications and closing documents. 

Source: http://www.ni.com/iiournal-news/index.ssf/2015/Q3/ex- 
keamy councilman pleads gu.html 

4. March 9, National Mortgage News - (National) Six charged in loan modification 
scheme. Six suspects were charged in Salt Lake City March 5 for their supposed roles 
in a loan modification scheme that defrauded over 10,000 individuals nationwide out of 
more than $33 million. Authorities allege the suspects created CC Brown Law LLC in 
2009 to execute a largely telemarketing-based scheme to sell fake home loan 
modification services to distressed homeowners then kept the customers’ money 
without performing the services. 

Source: http://www.nationalmortgagenews.com/news/distressed/six-charged-in-loan- 
modification-scheme-1046193-l.html 



For another story, see item 21 
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Transportation Systems Sector 

5. March 10, WRAL 5 Raleigh - (North Carolina) US 301 reopened after Amtrak crash 
in Halifax. An Amtrak train crashed into a semi-truck stuck on the tracks at the 
intersection of Highway 301 and North Carolina Highway 903 (N.C. 103) in Halifax 
March 9, derailing the train and leaving 55 passengers injured. Highway 301 reopened 
March 10, 18 hours after closing due to the accident while N.C. 903 remained closed as 
crews worked to clear the debris and remove the electrical building being transported 
by the semi-truck. 

Source: http://www.wral.com/us-301-reopened-after-amtrak-crash-in- 
halifax/1 4503 875/ 

6. March 10, New England Cable News - (Maine) 4 killed in head-on crash in northern 
Maine. Route 161 in Rainbow Cove in Township 16-Range 4, Maine, was closed for 
more than 7 hours March 9 due to a head-on collision that killed 4 people. 

Source: http://www.necn.com/news/new-england/4-Killed-in-Head-Qn-Crash-in- 
Maine-295623171.html 

7. March 10, WHIO 7 Dayton - (Ohio) Victim of 1-75 crash identified. Authorities 
reopened one southbound lane of Interstate 75 in Troy, Ohio, after closing all lanes for 
2 hours March 9 after a vehicle overturned during a lane change and landed on a 
guardrail killing one person and leaving two others injured. 
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Source: http://www.whio.com/news/news/local/wreck-on-i-75-south-in-miami-county- 
shuts-lanes/nkRsb/ 



8. March 9, KHOU 11 Houston - (Texas) Leak contained after 2 vessels collide in 
Houston Ship Channel. Two ships, a bulk carrier and a chemical tanker hauling 
216,000 barrels of the gasoline additive MTBE, collided in the Houston Ship Channel 
near Morgan’s Point in La Porte, Texas, and began spilling an unknown amount of 
MTBE into the water prompting the closure of the channel in both directions March 9. 
Authorities reported that the spill was contained while a shelter- in-place order remained 
in effect for about 300 residents. 

Source: http://www.kvue.com/story/news/state/2015/03/09/leak-contained-after-2- 
vessels-collide-in-houston-ship-channel/2467 8733/ 

9. March 9, KMGH 7 Denver - (Colorado) Highway 74 reopens after rock slide. 
Highway 74 in Bear Creek Canyon between Morrison and Kittredge in Jefferson 
County reopened March 9 after closing for approximately 15 hours following a rock 
slide March 8 that blocked the westbound lane and forced the highway to close. 

Source: http://www.thedenverchannel.com/news/local-news/large-boulders-come- 
down-on-highway74-west-of-morrison 

For another story, see item 10 
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Food and Agriculture Sector 

10. March 10, RiverTowns.net - (Wisconsin) Two in custody after bomb scare in 
Roberts. Police found a homemade explosive device and two suspects are in custody 
after investigating a suspicious vehicle located outside a Frito-Lay distribution center in 
Roberts, Wisconsin, prompting the relocation of Daisy Hill Early Learning’s 4k classes 
to a nearby elementary school March 10. A secured perimeter was placed around 
several businesses and a portion of Highway 12 was closed for 2 hours while police 
investigated and the Marathon County bomb squad rendered the device safe. 

Source: http://www.rivertowns.net/news/region/3696442-update-traffic-re-opens- 
roberts-after-bomb-scare 



11. March 9, W1BW 13 Topeka - (Kansas) Reser's issues statement on last weeks 
ammonia leak. An Occupational Safety and Health Administration representative 
reported March 9 that the agency is investigating a reported ammonia leak at the 
Reser’s Fine Foods plant in Topeka March 3. Reser’s Fine Foods officials reported that 
the company also launched an investigation into the incident. 

Source: http://www.wibw.com/home/headlines/Resers-Issues-Statement-On-Last- 
Weeks-Ammonia-Leak-295637401.html 
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Water and Wastewater Systems Sector 



12. March 10, Associated Press - (North Dakota) Nearly 1.7K gallons of brine spill in 
Williams County. The North Dakota Department of Health announced March 9 that a 
truck overflow caused about 1,680 gallons of brine to spill in Williams County and 
affect a nearby creek. Officials worked on a remediation plan and are investigating the 
impact of water quality. 

Source: http://www.kxnet.com/storv/28348307/nearly-17k-gallons-of-brine-spill-in- 
williams-county 



For another story, see item 8 
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Healthcare and Public Health Sector 

Nothing to report 
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Government Facilities Sector 

13. March 10, Springfield Republican - (Massachusetts) Gas leak at Monson’s Quarry 
Hill school caused by ice falling from roof: Columbia Gas. Classes were canceled at 
Quarry Hill Community School in Monson, Massachusetts, March 10 due to a gas leak 
caused by snow and ice falling from the roof which damaged a gas meter. Officials 
found a small amount of gas by the pool area of the building and repairs were expected 
to take several hours. 

Source: 

http://www.masslive.com/news/index.ssf/2015/03/gas leak at quarry hill school.html 

14. March 9, Associated Press - (Florida) Florida’s top law agency investigating 
cyberattack on school standardized testing program. The Florida Department of 
Education Commissioner reported March 9 that the State’s new online standardized test 
was the target of a cyber- attack March 5, causing issues with log-ins and prompting 
computer screens to turn white. The vendor providing the test notified officials of the 
attack and authorities are continuing to investigate. 

Source: 

http://www.greenfieldreporter.eom/view/story/185bca9f8el44d37a57f2aac2365594b/F 
L— School-Testing 

15. March 9, Chico Enterprise -Record - (California) Willows High evacuated after 
package is mailed to school; police say school officials received threats. Willows 
High School in California was evacuated and students were dismissed March 9 after a 
suspicious package addressed to the principal was delivered to the school prompting a 
police response. A bomb squad detonated the package which contained paperwork 
wrapped in a bag with rope, and classes were scheduled to resume March 10. 
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Source: http://www.chicoer.com/general-news/201503Q9/willows-high-evacuated- 
after-package-is-mailed-to-school-police-sav-school-officials-received-threats 



16. March 9, KUSA 9 Denver - (Colorado) Aurora school loses power after traffic 
crash. A power outage caused by a transformer that was damaged in a traffic accident 
prompted the closure of Aurora Quest K-8 in Colorado March 9. Classes were expected 
to resume March 10. 

Source: http://www.9news.com/storv/news/education/2015/03/09/aurora-quest-k-8- 
power-outage/24638465/ 

For another story, see item 10 



[ Return to top ] 

Emergency Services Sector 

17. March 9, KOKI 23 Tulsa - (Oklahoma) Authorities searching for prison escapees. 
Officials are searching for two inmates who escaped from the Mack Alford 
Correctional Center in Stringtown March 9 after personnel discovered a hole cut in a 
fence. Authorities warned that both suspects should be considered dangerous. 

Source: http://www.fox23.com/news/news/local/authorities-searching-prison- 
escapees/nkRPh/ 



T Return to top i 

Information Technology Sector 

18. March 10, Softpedia - (International) Exploit code published for Elasticsearch 
remote code execution flaw. Security researchers at Xiphos Research created an 
exploit for a glitch in Elasticsearch versions earlier than 1.3.8 and 1.4.3 that allows 
server-side code execution by passing Groovy code in a search query and executing it 
in the sandbox. The glitch was patched in updates released February 11. 

Source: http://news.softpedia.com/news/Exploit-Code-Published-for-Elasticsearch- 
Remote-Code-Execution-Flaw-475361.shtml 

19. March 10, Threatpost - (International) Yahoo patches critical eCommerce, small 
business vulnerabilities. Yahoo recently patched vulnerabilities discovered by security 
researchers that could have allowed attackers to gain complete access to any user-run 
eCommerce Web site hosted on Yahoo’s eCommerce platform, Yahoo Small Business, 
including all site administration privileges, access to personally identifiable 
information, and control over prices of items in any Yahoo store. 

Source: https://threatpost.com/vahoo-patches-critical-ecommerce-small-business- 
vulnerabilities/1 11519 



20. March 9, Softpedia - (International) Row Hammer DRAM bug exploited, unlocks 
access to physical memory. Security researchers from Google’s Project Zero 
leveraged a known vulnerability, dubbed Row Hammer, in some dynamic random- 
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access memory (DRAM) chips to identify one exploit that runs as a Native Client 
program and escalates privilege to call the host system SYSCALLs directly, and 
another that runs as a normal process on Linux and escalates privilege and allows 
access to data in the entire physical memory. 

Source: http://news.softpedia.com/news/Row-Hammer-DRAM-Bug-Exploited- 
Unlocks-Access-to-Physical-Memorv-475303.shtml 



21. March 9, NBC News - (International) FBI investigates possible ISIS supporters’ 
hack of Western sites. The FBI is investigating after hackers claiming to be affiliated 
with the Islamic State of Iraq and Syria (ISIS) placed black flags attributed with the 
group, the words “hacked by ISIS, we are everywhere,” an invalid Facebook address, 
and an Adobe Flash audio plugin that played a song in Arabic on several U.S. Web 
sites over the weekend of March 7. Some of the businesses targeted during the attack 
include a speedway in Ohio, a Goodwill store and digital agency in Missouri, a historic 
condominium complex in New York, a zoo in California, and restaurants in Minnesota, 
Massachusetts, and Ohio. 

Source: http://www.nbcnews.com/news/us-news/hackers-claiming-be-isis-hit-rnontana- 
credit-union-n3 1 9696 



Internet Alert Dashboard 



To report cyber infrastructure incidents or to request information, please contact US-CERT at soc@us-cert.gov or 
visit their Web site: http://www.us-cert.gov 

Information on IT information sharing and analysis can be found at the IT ISAC (Information Sharing and 
Analysis Center) Web site: http://www.it-isac.org 
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Communications Sector 

Nothing to report 
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Commercial Facilities Sector 

22. March 10, WPRO 99. 7 FM Providence - (Rhode Island) 5 alarm fire burns through 
factory building in Providence. The Rhode Island Department of Environmental 
Management advised Providence residents to limit outdoor activity March 10 due to 
poor air quality in the area caused by 5-alarm fire at a vacant factory building. 
Firefighters contained the blaze before it spread to adjacent businesses while the 
structure was severely damaged. 

Source: http://www.630wpro.corn/2015/03/10/5-alarm-fire-burns-through-factorv- 
building-in-providence/ 

23. March 9, New England Cable News - (Massachusetts) Roof collapse at shopping 
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plaza under investigation. A shopping plaza in Holden, Massachusetts, was safely 
evacuated March 9 after the structure’s roof partially collapsed under the weight of 
heavy snow. Stores located inside the shopping center remained closed while engineers 
inspected the building including a Dollar Tree store that suffered most of the damage 
caused by the collapse. 

Source: http://www.necn.com/news/new-england/Roof-Collapse-at-Shopping-Plaza- 
295674941.html 



24. March 9, Palm Beach Post - (Florida) Gas leak in suburban Boca plaza stopped. 
The Sandalfoot Plaza shopping center in Boca Raton was evacuated for several hours 
March 9 after firefighters found gas leaking from several storm drains. The plaza was 
cleared to reopen after crews repaired a leaking 2-inch gas line. 

Source: http://www.palmbeachpost.com/news/news/gas-leak-in-suburban-boca- 
prompts-evacuations-in-p/nkRhm/ 

25. March 9, WTOC 11 Savannah - (Georgia) 22 people displaced after Thunderbolt 
apartment fire. A March 9 fire at the River Crossing Apartments complex in 
Thunderbolt, Georgia, displaced 22 residents after the blaze that was sparked during 
repair work on a washing machine spread throughout the structure. A few firefighters 
were treated at the scene for unspecified injuries. 

Source: http://www.wtvm.com/story/28308645/22-people-displaced-after-thunderbolt- 
apartment-fire 

For another story, see item 21 
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Dams Sector 

Nothing to report 
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NO ACTIVE ALERTS 
www.DHS.gov/alerts 



Department of Homeland Security (DHS) 

DHS Daily Open Source Infrastructure Report Contact Information 



About the reports - The DHS Daily Open Source Infrastructure Report is a daily [Monday through Friday] 
summary of open-source published information concerning significant critical infrastructure issues. The DHS Daily 
Open Source Infrastructure Report is archived for 10 days on the Department of Homeland Security Web site: 
http://www.dhs.gov/IPDailyReport 

Contact Information 

Content and Suggestions: Send mail to cikr.productfeedback@hq.dhs.gov or contact the DHS 

Daily Report Team at (703) 942-8590 

Subscribe to the Distribution List: Visit the DHS Daily Open Source Infrastructure Report and follow 

instructions to Get e-mail updates when this information changes . 

Removal from Distribution List: Send mail to support@ govdelivery.com . 



Contact DHS 

To report physical infrastructure incidents or to request information, please contact the National Infrastructure 
Coordinating Center at nicc@hq.dhs.gov or (202) 282-9201. 

To report cyber infrastructure incidents or to request information, please contact US-CERT at soc@us-cert.gov or visit 
their Web page at www.us-cert.gov . 

Department of Homeland Security Disclaimer 

The DHS Daily Open Source Infrastructure Report is a non-commercial publication intended to educate and inform 
personnel engaged in infrastructure protection. Further reproduction or redistribution is subject to original copyright 
restrictions. DHS provides no warranty of ownership of the copyright, or accuracy with respect to the original source 
material. 
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